By the time the fifth survey invite rolled into my inbox, my paranoia tentacles were twitching. I can understand the temptation to use Survey Monkey. It’s well known, it’s free (for basic surveys; more sophisticated questionnaires will cost you) and it’s easy to use. But I also know that it’s an American company and its data is stored in the United States. As such, it is subject to the U.S. Patriot Act, which allows American authorities access to its data.

Many Canadian provinces, municipalities and educational institutions don’t allow their departments to use data-collection services that store data outside of the country. Canadian university research ethics boards require researchers using Survey Monkey to include a warning such as that mandated by Mount Allison University:

"Please note that the online survey is hosted by "Survey Monkey" which is a web survey company located in the USA. All responses to the survey will be stored and accessed in the USA. This company is subject to U.S. laws, in particular, to the U.S. Patriot Act that allows authorities access to the records of internet service providers. If you choose to participate in the survey you understand that your responses to the questions will be stored and accessed in the USA. The security and privacy policy for Survey Monkey can be viewed at http://www.surveymonkey.com/".

So why does the City of Vancouver, which is officially on record as endorsing open source software, use a commercial, American product that cannot guarantee the security of its data?

According to the City of Vancouver :

“The City used survey monkey last year, because 1) it is free, and 2) we were able to export all the data into an excel spreadsheet, and therefore store it within our domain. There were no other privacy implications considered as the survey was anonymous. No name or identification was required from participants.”

Fair enough, except that SurveyMonkey does collect at least one piece of identifying information -- your computer’s IP address. Otherwise, it could not determine whether you’ve already taken the survey. In some circumstances, the IP address (especially if it’s a static address) could be used to help identify you. It would take a lot of work, and most of us probably don’t have to worry about the U.S. government being interested in how we feel about local bus service, but the risk is there.

B.C.’s Freedom of Personal Information and Protection of Privacy Act states that personal information must be stored in Canada, with certain exceptions (Section 30.1). “Personal information” is defined in the Act as “recordable information about an identifiable individual other than contact information”, which is a bit broader than the “name or identification” mentioned by the City's web redevelopment director above.

Probably the City didn’t overstep the privacy line here, but who can say that the next City survey won't ask for information that could be traced back to individuals? Why take chances when there are alternatives, ones that are free and open source, and/or made-in-Canada?

It’s free, it’s open source and you install it on your own server, so you can be sure the data collected stays in Canada. I’ve been using it for years for surveys relating to my academic research. It’s easy to install and easy to use. Data can be downloaded and analyzed in Excel, SPSS and other statistical software, which would seem to satisfy the city's needs. It’s also more sophisticated than SurveyMonkey, allowing conditional questioning, selective invitations, and private access keys. If I can install it on my home server, surely the City of Vancouver has tech people who would find it a breeze to set up.

But if Limesurvey is too daunting for the city’s technical staff, there is a made-in-Canada alternative to SurveyMonkey: FluidSurveys (www.fluidsurveys.com).

FluidSurveys promises that their data is stored in Canada and therefore not subject to the U.S. Patriot Act. Like SurveyMonkey, it’s free for basic surveys. (Another service, Hosted in Canada Surveys, charges an $80 setup fee and $18.95/month/survey. However, it uses Limesurvey as its engine, so if you have the basic tech savvy and ftp access to your webhost, you’d be better off saving the money and installing Limesurvey yourself.)

So the next time you receive an email invitation to take a survey that links to SurveyMonkey, stop and think before responding. Are you comfortable with your responses being stored outside the country? If not, ignore the impulse to click that link and instead let the organization that sent out the survey know that it’s time to get the SurveyMonkey off our backs.